AZ-305 Practice Test 46 — 15 Questions

Question 1

A company is deploying a web application on Azure App Service. The application must authenticate users with their Microsoft Entra ID credentials. The development team wants to use the Microsoft Authentication Library (MSAL) for authentication. Which App Service authentication feature should they use to simplify integration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the App Service authentication / authorization feature to use Microsoft Entra ID. The App Service authentication / authorization feature (also known as Easy Auth) provides a built-in, code-free integration with Microsoft Entra ID. By enabling this feature and configuring it to use Microsoft Entra ID, the App Service automatically handles token validation, session management, and redirects, allowing the development team to use MSAL on the client side for sign-in without writing server-side authentication logic.

Answer

Use Application Insights to capture authentication logs

Answer

Use Azure API Management to handle authentication

Answer

Use Azure AD B2C for identity management

Question 2

You need to design a monitoring solution for a set of Azure virtual machines running a business-critical application. The solution must provide centralized log management, enable real-time analysis of security events, and support custom alerts for anomalous behavior. Which Azure service should you use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that provides centralized log management, real-time security event analysis, and built-in support for custom analytics rules to detect anomalous behavior. Unlike Azure Monitor or Log Analytics, Sentinel is specifically designed for security-focused monitoring and can ingest logs from multiple sources, including Azure VMs, and use machine learning to identify threats.

Answer

Azure Log Analytics

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 3

A company uses Microsoft Entra ID. They need to grant external partners access to an internal application for a limited time (30 days). The access must be approved by a manager from the partner's organization. After the period ends, access should automatically be removed. The company also wants to send email reminders 7 days before expiration. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management is the correct feature because it provides automated access lifecycle management for external users, including time-limited access packages, approval workflows (including external manager approval), and automatic expiration with email notifications. This directly matches the requirement for 30-day access with partner manager approval and 7-day reminder emails.

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Question 4

A company plans to deploy a stateless web application on Azure virtual machines. They want to ensure that the application remains available in the event of a hardware failure within a single Azure datacenter. The VMs must be placed in a way that ensures they are on different physical servers and racks, but are still within the same datacenter. Which deployment strategy should they use?

Accepted Answer

Deploy the VMs in an Availability Set.. An Availability Set ensures that VMs are distributed across multiple fault domains (different physical servers, racks, and network switches) and update domains within a single Azure datacenter. This protects against hardware failures in that datacenter by guaranteeing that not all VMs are affected by the same local failure, while keeping them in the same datacenter for low-latency communication.

Answer

Deploy the VMs in different Availability Zones.

Answer

Deploy the VMs in a single Virtual Machine Scale Set with a large instance count.

Answer

Deploy each VM in a separate resource group.

Question 5

A company runs a critical web application on Azure VMs in the West US region. They need a disaster recovery solution that replicates the VMs to the East US region. The recovery point objective (RPO) must be 30 minutes, and the recovery time objective (RTO) must be 1 hour. The company also needs to perform quarterly disaster recovery drills without impacting the production environment. Additionally, after a failover, the solution must automatically update traffic management to route users to the East US region. Which combination of Azure services should they use?

Accepted Answer

Azure Site Recovery and Azure Traffic Manager. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs from West US to East US, meeting the 30-minute RPO and 1-hour RTO. Azure Traffic Manager automatically updates DNS-based traffic routing to the East US region after failover, ensuring users are redirected without manual intervention. This combination satisfies all requirements: DR replication, RPO/RTO, quarterly drills (via test failover), and automated traffic management.

Answer

Azure Backup and Azure Traffic Manager

Answer

Azure Site Recovery and Azure Front Door

Answer

Azure Backup and Azure Front Door

Question 6

A company runs a critical application on an Azure virtual machine in the West US region. They want to enable disaster recovery to East US with the ability to perform non-disruptive DR drills. They need an RPO of a few minutes. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct service because it provides continuous replication of Azure VMs from a primary region (West US) to a secondary region (East US) with a Recovery Point Objective (RPO) of a few minutes. It also supports non-disruptive disaster recovery drills by allowing you to perform test failovers in an isolated network without impacting the production workload.

Answer

Azure Backup

Answer

Azure Traffic Manager

Answer

Azure Blueprints

Question 7

Which THREE Azure services can be used to monitor the performance of a web application? (Choose three.)

Accepted Answer

Application Insights. Application Insights (B) is correct because it is the APM feature of Azure Monitor that automatically collects request rates, response times, failure rates, dependency calls, and server/client performance telemetry for web applications. Azure Monitor Metrics (C) is correct because it stores numeric time-series performance data such as CPU percentage, memory usage, request counts, and response times that can be charted and alerted on. Azure Monitor Logs (E) is correct because Log Analytics workspaces collect and query detailed telemetry (e.g., via KQL over AppRequests, Perf, and AppTraces tables) to analyze web app performance and trends. Azure Policy (A) is incorrect because it enforces governance and compliance rules on resources rather than monitoring runtime performance. Microsoft Defender for Cloud (D) is incorrect because it provides security posture management and threat protection, not application performance monitoring.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 8

Which TWO Azure services can be used to store unstructured data such as documents, images, and videos?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is designed for storing massive amounts of unstructured data, such as documents, images, and videos, as objects (blobs) in a flat namespace. It supports three types of blobs (block, append, and page) and provides REST APIs for access, making it ideal for scalable, cost-effective storage of binary and text data.

Answer

Azure Files

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Question 9

A company needs to store audit logs for 7 years to meet compliance requirements. The logs are generated at a high volume and must be cost-effective. They need to run occasional queries on recent logs (less than 30 days old) but rarely on older ones. Which Azure storage solution should they recommend?

Accepted Answer

Azure Blob Storage with lifecycle management to Archive tier. Azure Blob Storage with lifecycle management to the Archive tier is the correct solution because it provides a cost-effective storage hierarchy for high-volume audit logs. Lifecycle management can automatically move logs from the Hot or Cool tier to the Archive tier after 30 days, aligning with the requirement to keep recent logs queryable while minimizing costs for older logs that are rarely accessed. The Archive tier offers the lowest storage cost, making it ideal for 7-year retention of audit data.

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Answer

Azure Log Analytics

Question 10

Which TWO of the following are true about Azure Blob Storage access tiers?

Accepted Answer

The cool access tier has lower storage costs but higher access costs compared to the hot tier. Azure Blob Storage's cool access tier is designed for infrequently accessed data, offering lower storage costs than the hot tier but higher access costs (per GB read/write) to compensate for the reduced storage price. This cost trade-off aligns with typical usage patterns where data is stored long-term but accessed less often.

Answer

The cool access tier is designed for data that is accessed more frequently than the hot tier

Answer

The archive access tier is suitable for data that is accessed daily

Answer

The hot access tier has the lowest storage costs

Question 11

A company runs a critical application on Azure VMs in the West US region. They want to protect against a regional disaster by replicating VMs to East US using Azure Site Recovery. They have both managed and unmanaged disks. They need to ensure that after failover, the recovery VMs are automatically placed in a specific availability set to support the application's multi-tier architecture. Additionally, they want to minimize downtime during planned failover. Which configuration should they use?

Accepted Answer

Configure a recovery plan that includes the VMs and specifies the target availability set and failover order. A recovery plan in Azure Site Recovery allows you to group VMs, specify the target availability set, and define the failover order. This ensures that after failover, the recovery VMs are automatically placed in the specified availability set, supporting the application's multi-tier architecture. Additionally, recovery plans enable you to automate and sequence failover steps, minimizing downtime during planned failover by orchestrating the process efficiently.

Answer

Set the target availability set in each VM's replication settings individually without a recovery plan

Answer

Use Azure Traffic Manager to route traffic to the secondary region after manual failover

Answer

Enable consistency groups across the VMs using a replication policy

Question 12

A financial services company needs to store transaction logs for regulatory compliance. The logs must be stored in a cost-effective manner, and they must be immutable to prevent tampering. The logs are accessed infrequently but must be retained for 7 years. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage with immutable storage policy and cool access tier. Azure Blob Storage with an immutable storage policy (WORM) ensures that transaction logs cannot be modified or deleted during the retention period, meeting compliance requirements. The cool access tier is cost-effective for infrequently accessed data, and the 7-year retention aligns with the policy's time-based retention. This combination provides both immutability and low-cost storage for long-term archival.

Answer

Azure Cosmos DB with time-to-live (TTL)

Answer

Azure SQL Database with long-term retention backup

Answer

Azure Files with share snapshots

Question 13

You are designing a globally distributed application that requires low-latency reads and writes for a web application with user session data. The solution must support multi-master writes and provide 99.999% availability. Which Azure data service meets these requirements?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it natively supports multi-master writes across multiple regions, enabling low-latency reads and writes globally. It offers a 99.999% availability SLA when configured with multiple write regions, and its turnkey global distribution ensures user session data is replicated with consistency options tailored for web applications.

Answer

Azure SQL Database

Answer

Azure Cache for Redis

Answer

Azure Table Storage

Question 14

A company needs a fully managed NoSQL database for a JSON document-oriented application that requires low latency (single-digit milliseconds) for reads and writes at any scale. The application will run globally and needs multi-region writes with automatic failover. Which Azure data store should they use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that natively supports JSON documents, offers single-digit millisecond latency for reads and writes at any scale, and provides multi-region writes with automatic failover through its multi-master replication capability. Its global distribution model allows you to configure multiple write regions, ensuring high availability and low latency worldwide.

Answer

Azure Table Storage

Answer

Azure SQL Database

Answer

Azure Cache for Redis

Question 15

A company deploys a multi-tier application on Azure virtual machines. They need to implement disaster recovery using Azure Site Recovery. The recovery plan must ensure that the database VMs are started before the application VMs, and the application VMs before the web VMs. They also need to run a script after failover to update DNS records. Which ASR feature should they use?

Accepted Answer

Recovery Plan with custom groups and script actions. Azure Site Recovery (ASR) Recovery Plans allow you to orchestrate the order of VM failover by grouping VMs into custom groups and adding pre- and post-actions. By placing database VMs in Group 1, application VMs in Group 2, and web VMs in Group 3, you enforce the required startup sequence. Script actions (e.g., Azure Automation runbooks or PowerShell scripts) can be inserted at specific points in the plan to update DNS records after failover, making option B the correct choice.

Answer

Recovery Plan with manual steps

Answer

Replication policy with crash-consistent snapshots

Answer

Azure Automation runbook